Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
08/07/2024, 05:11
General
-
Target
2024-07-08_b7ebae68c12fa4d9e6cc68ccf374e0c8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
b7ebae68c12fa4d9e6cc68ccf374e0c8
-
SHA1
82539627c286ceaa8dfd4dcc95673d07417a121f
-
SHA256
ddfc540cd25b8ac0759fba976fbd4434cbcc2197b16b3e78dcebc56b054242da
-
SHA512
c6976a3c9184f41302a779ab152d0f0a6495b27d406cf0195919267cc536defcbca868ab7f44393d6df00c8af56e18c1f234fd06c6be3872c2e9b4d70227ee91
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUP:E+b56utgpPF8u/7P
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-08_b7ebae68c12fa4d9e6cc68ccf374e0c8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-08_b7ebae68c12fa4d9e6cc68ccf374e0c8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\XHoIzEF.exeC:\Windows\System\XHoIzEF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UNKGJtR.exeC:\Windows\System\UNKGJtR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WFLzjpv.exeC:\Windows\System\WFLzjpv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bFPADyq.exeC:\Windows\System\bFPADyq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pylunQl.exeC:\Windows\System\pylunQl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sTtBudI.exeC:\Windows\System\sTtBudI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wgiqNdV.exeC:\Windows\System\wgiqNdV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EGFTTYZ.exeC:\Windows\System\EGFTTYZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NnyJSZS.exeC:\Windows\System\NnyJSZS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KXmYiUf.exeC:\Windows\System\KXmYiUf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VIUUYnP.exeC:\Windows\System\VIUUYnP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HzFXqFk.exeC:\Windows\System\HzFXqFk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EHKsweX.exeC:\Windows\System\EHKsweX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QQZpwJJ.exeC:\Windows\System\QQZpwJJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DrDQCPF.exeC:\Windows\System\DrDQCPF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rdCyemx.exeC:\Windows\System\rdCyemx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ClpeFaA.exeC:\Windows\System\ClpeFaA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JIohvPS.exeC:\Windows\System\JIohvPS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nOsXjSF.exeC:\Windows\System\nOsXjSF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yKWHUcO.exeC:\Windows\System\yKWHUcO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FbCHmXY.exeC:\Windows\System\FbCHmXY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5b50083548cf4e71ac974affc6d2cb0f6
SHA1cc66b33e874cf269791440b5e946eba577e9e343
SHA25671e3612bb57110e4c82401f904bfd1e4a6569e554102720d2a72fedf113d240a
SHA512f773c862f4516b322c3ac9d86f816abe4115959c9d928f423872ce9145877936835c4240dc1b8e6bfcdb947c5919b4589ee2a6026cfe277ff8074cbe786a4fbb
-
Filesize
5.9MB
MD58e5e612cb3c77c236b639e132edb05b9
SHA15160669ba18642b2e023021a8e4143c2f4e3d66a
SHA256a27beae6d23c7b2fff37bc0ab3884de2a790cd7d808d2ab98e0a3a0de92fe7ff
SHA51256673cc25c15491dc40120dd38946a49d7c816421ebbffcde9a5951e63f9730ff46a702a30e849a2b496ae8dd440e1958fa6cfaf195bf8fcc642232314da85ba
-
Filesize
5.9MB
MD58485cd43be4acb2d7200d231961c32f9
SHA1fc544e49dca3e3e6fc7c0b69b17e0b4dee0d0917
SHA2567326ede9871147fc98ebe22c95b3a13ae1f636855dd9892d09c8fbae2fe3cc08
SHA5129909e47c8893349bc552f8c8cbfc156cff0ae3238d73bc94636427ece5f87d6613c41a29800fa6f843078cec0a430913f265a61ba376645c8b39ff833f9bc4c1
-
Filesize
5.9MB
MD568dee791dace969a72928ec36ad3b94b
SHA1c75705d2b2fd26360c47e191614f6ccfb4af3812
SHA2566ccd3c153a2147a2e0ee6f31beefa82ae1208fa99bdfbd20ddf128442ea530a3
SHA51241769675b4643fffa0b082b770b55725655790c3e56100c7cac1ad10038027a19a51528cc6d8a4136c1a05ca289d1e44dc14e7d701beccf317e8dc88f9d2aacd
-
Filesize
5.9MB
MD5126b034c1859616efdecd76ab6ddd8e6
SHA18bac20533cb1e4dc4159e651657d71bf2f1cf9cd
SHA2565b4351a8101e74444c1e5c6aba4c6c3c369436549afce2617148d33061b4bd73
SHA51228753e2b9d7afc69f33c5b9bdc6cae54928e35d3b56939da0effd4e0b39ca50a26b6d553bc73a712ee77e965b2cdd286fd27f4c9c81d31cbc1b1de4b76a73d81
-
Filesize
5.9MB
MD53cf9c546000aad676142d91598c7d144
SHA1b00447da79473bd3c028cfd795c024f74682e1d2
SHA2565eb7761c64ba6867b24336c6926b5fca3153863907a21241c36f0fe9cd9fff20
SHA51232d67dec2799fbf289e21555348e1fc04a5b4d45fe3a1c35b516c0f796d3cb011352c832e5dcf9e20333435ac7426b7789bd2a041f8f18f6e1c112412030ab25
-
Filesize
5.9MB
MD5c7f94a3a7a7001865a4984df493dc50c
SHA128e91fc65896fad743bea004dfe87b4ebc9395ed
SHA2561201afed0109c821efe90a01b7d40578cddf5063ace409ed0081435d590df7dc
SHA512ba84a2725c75ed36a4313abd6ffe39bb3618c7506e2d5df83a81fdeace5c71201ec665fb50048a4439ea6c4bb266fb70dfa015195f4a0fb96d00eba5ce4be29d
-
Filesize
5.9MB
MD55a6d066fd207d8b1d85269b7bb1c0d03
SHA1b395f452715748b8abad48cafc77d1e5e2e31596
SHA256123a2f9fd715839c9b49f9f36096e98c509a2929bf788673fd229fcdd8af52ab
SHA512c3903f7fd5128f7acad6bc3d1b521ae7d1d3bd558073cedc3c8b0bda145be96f81cb0ff6010c5edf6a363b0f3840d8edf136830f7f19c731a1d5f0aa6514826f
-
Filesize
5.9MB
MD534e528554c39f3cb71a0d9f91ade67f0
SHA1a1d064c5c59db38f2695098938bfb860729d67a7
SHA25699afe29dff7cc95f4c2c579bbbe75936572b547b0be87625c5f3252e3bf17581
SHA512f5e278fc5997f6dcdde95697f57c81a469659af229ee1ae16e924588c6331e485dff59f69f2434caaeecd6e625dc71277884bf8f04ba335effd1648a99834882
-
Filesize
5.9MB
MD5e2caa0e9d6db0f3a7dd8b826f790feb3
SHA13c574acf3f533ca9bbe1b7c406acf85e9d9bc27c
SHA256d058fb8e61520f647b87771aeaf9b85c055cd63cb5e73369596a38e7d9b6b556
SHA5129b645d4c688e3689449bfcadb8408b5b2e571072a2d8e389bf92f2a7015770defc17154ca8ad4db4395e785110d31d301f8da6af0c38755ba5114b8b5481c05e
-
Filesize
5.9MB
MD5d43fc551edcf75e78f03890da05f3038
SHA194736731e58285cb8ef4683618475fc2a81a2638
SHA256e74de8529a2aefd981ba14d8f6216a1b6bd12e942ebf95c6fd1ceb8e5df7b754
SHA512e2b5cdd12638bfc13e1a5a139759bfd49601ce8de7a18abe8182b4081a0015b617fdc4ae65bf8c1cac8928bbdafcd55d1e3d2b0a974154b40ab050b45404dd55
-
Filesize
5.9MB
MD5c8a0e049430bf2249e77c2bfdb5c2133
SHA1984af6b4fd90f6274728725cfd18d62e52e7b172
SHA2565272add836e67f894a68be09f0cfc98f8f09ea04c495089d6b1c22e05ef7e0dd
SHA5121bf64516ec0e630a572e5979bd30dedd29fdfb5985442b198eecd82ecf43845e0c24eddd57670607e1845992f89afeaf160581c47237e4048b33cf746c3490ad
-
Filesize
5.9MB
MD541599207ef56557617bb05cf31a84e0f
SHA196607215e5e9165b475557cd73ccdfac1fe2f15c
SHA2567311e022044b389d402259f1512cd7365ff791fa6eabf2ddb819c4e6996ac6b0
SHA51254f9045ed11087c645835bfabc98f94059ae746a7cfb602eb8b1b477e82f08ee3f15a286ea8af9062c020ea214374df4825c7260d026e9c9f8b975f3efba3f01
-
Filesize
5.9MB
MD5c8116c16856db978f9c2b8e8c42af926
SHA1b1286a2dcef6b4a0fc81f328b5ac7fb40227fcb1
SHA2568a6d3aa820c6cb3e6eb8a6b956250abddd83d7e5a95fc2ba51f9fd419819c567
SHA512250b51a7a36a9b071b34d5ef3587e1fac4f3518a79b92489e2862adb16abaa400f291f66ea61ccf91f8f9e3e5177e97bafe8b4dcbcd8228b9c33a726ad3de1e6
-
Filesize
5.9MB
MD5a85dfa47adff4ae7772ea6fbd9d4efe4
SHA14d724651ac74f30cf1b672deff3696ab29325ad4
SHA256446714a87d25edc0beca3b61b75c5840579df5cd30f417ea815e7b2d0b341368
SHA51282392028801687dda345e604455741ba36e3fe68640834d6aeec9cd6788fe72de1d8c0470816f06ba05982ea5f599024ff93514bd74f41d965c3162da890b0e6
-
Filesize
5.9MB
MD5dddb2b7b5fbbe0dec68371a6033cc988
SHA19b48961aea6b63ddce885205b0963f15b5d7dd0f
SHA256c0e5586be17b56a19cdd6709024a5637cbb7ad80b76fbdcd6f6ba0162376aefd
SHA5120350573ed9e136211c7e42593cdcabcff12bbca6b554b818481852c9b5eb94e967c4ba419c5f6266543f6412c89d4b54e1a69b289054e5719c550d4895348379
-
Filesize
5.9MB
MD5f70fb6a416397b62600f211f4dfed0a9
SHA1e88a9195e3fc9c1577cea9cc812e656c72dd70a6
SHA256618461063bb16f6cbad206ac023dd94bde4aab509ea91bd6960a26990579e86a
SHA512f4456acc9c0aa5af7d4628314b10ba4df23b7a660d8025bd58c5235685c90ca234f52c65b051fa1015ca2802c873dd42143aae724f30bd9bee85cb063e8b5062
-
Filesize
5.9MB
MD5eda514ba95f2f43231835c9ef86c09d0
SHA1215684e3693ce4760ff20bbb38e5e7ccb5e9c1df
SHA256e28eebeabdca8b46e0d24bff258660b1ff0aa2d080a15543fd2c2db854686c59
SHA512839ff2c5717226cff318e67f50bf24a19357d9d3067fb86085062ac4bfb43f7fa0ba281a697652ae27aa009b663aadb2d62ecdf5fea9bd0e851afd35d187b325
-
Filesize
5.9MB
MD576d590452e089a0fc42fdad60d3009d2
SHA1f37bb91d8fee3d7962d1c130a4ca541a44655d95
SHA256c52c054e128b13d29711fc5ee437b7c70f0f6e656f8eb1022f8b14a7ea1b142b
SHA5126dcf45965aa525e5b9231327c1b469ad751c3e3b7b15e592f2e3229e1a9f013b6c1054dafcfb7c7e93bfd14e829beec8ec865829ea5327688c4be3c369f0150d
-
Filesize
5.9MB
MD5d5b4d8f1eb9b18a866caed4414fc2a6a
SHA183c6dd61a6af37487618e3646584799506780fb6
SHA256c5703c97f5503e740289a55861e069676880752fb2be4c02815b286a148b6d8b
SHA512df728b2d08c70e2bb35232c3e54d98f469a3da3d49cd73828c6ff0827f41d73a68639e24a0c87c623a58acc9d2ff23639024d197acab50a39f7495626dd47f3c
-
Filesize
5.9MB
MD527ed47c0b96d120f5b9ebcd2eadbe895
SHA1f4a9f789704e21c777234526e32a2e5d49882f0b
SHA256754ffae1983ff13668e4edf9f8e5419a9928e1582981cd2cb0f31f7dfb1ab1f1
SHA512082a7bc2d8b249b2e22b35ec0d20c14632ab37d53040130c8bcd8a75903177115f2e4d991c50946ddecb05f201f112d39613894a687c7f0a269fa149c981a1ba
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB